v1.8.3

Security

Resolves all fourteen open zstd advisories (RUSTSEC-2026-0391, -0395 through -0406, -0410) by moving to zstd 0.14.3, zstd-safe 8.2.0, and zstd-sys 2.1.2 — including removing a second, vulnerable zstd copy that an unused transitive feature kept alive. A new dependency audit test keeps it from returning.

Scheduler

Actions are now sized from the usage workers actually report, and learned sizing survives capacity growth and scheduler restarts.

Worker reliability

Workers retry the action read at startup, a store the worker cannot reach no longer spends the action's retries, and a lost result still consumes max_job_retries.

Stores

The Redis store bounds every upload's temp key.

Observability

Bazel build events now carry GitHub job metadata, and a REAPI protobuf fuzz target joins the fuzz suite.

What's Changed

• docs(config-reference): regenerate for NativeLink v1.8.2 by @github-actions[bot] in #3055
• web: restore broken /resources/oreilly-bazel-book page by @modernmedici in #3042
• Update Rust crate zstd to 0.14.0 [SECURITY] by @renovate[bot] in #3056
• web: refresh the community page's fallback stats and hide a departed account by @MarcusSorealheis in #3059
• web: give the community page's offline contributor fallback real counts by @MarcusSorealheis in #3060
• Resolve all fourteen zstd RUSTSEC advisories by removing the vulnerable duplicate by @MarcusSorealheis in #3061
• Avoid embedding the Cargo manifest path by @matdexir in #3064
• Add REAPI protobuf fuzz target by @matdexir in #3057
• Add GitHub job metadata to Bazel build events by @MarcusSorealheis in #3067
• Redis store: bound the temp key of every upload by @amankrx in #3065
• Scheduler: size actions from the usage its workers report by @amankrx in #3066
• docs(llms): regenerate the repository llms files by @github-actions[bot] in #3019
• worker tests: import Semaphore on every platform by @modernmedici in #3074
• fix(ci): fix Clippy and Redis failures and restore Bazel PR checks by @MarcusSorealheis in #3069
• Fix learned resource sizing regressions on main by @MarcusSorealheis in #3070
• Worker: retry the action read at start, and a store the worker cannot reach does not spend the action's retries by @amankrx in #3075
• Scheduler: count a store loss only when the worker marks it, so a lost result still spends max_job_retries by @amankrx in #3081
• Release NativeLink v1.8.3 by @corcillo in #3068

Full Changelog: v1.8.2...v1.8.3